IBM Support

How to change Consumer Organization Owner if Owner left company?

Question & Answer


Question

How to change Consumer Organization Owner if Owner left company?

Answer

Step 1: Log in using the APIC toolkit using the userid of the catalog owner

apic login --username <username> --password <password> --server <apic-address> --realm provider/default-idp-2

Logged into dev.apic.ibm.com successfully

Here, the realm value will usually be provider/default-idp-2, unless you have configured a different user registry for API Manager logins. You can list the realms (without needing to login first), using this command:

apic identity-providers:list  --scope provider --server <apic-address>

default-idp-2

Step 2: Get the roles for the consumer org
In this step, we use the apic roles:list command to find the roles we can assign to a member of the consumer organization. For this, you'll need the name (not the title) of the consumer org. You can find the name by going to the Consumer Organizations view for the catalog and opening the Consumer Organization page. We need the role information in order to invite a new user to the consumer organization.

$HOME/Tools/apic roles:list --scope consumer-org --consumer-org <consumer-org-name> --org <provider-org-name> --catalog <catalog-name> --server <apic-address>

Step 3: Create a member invitation inviting the to-be owner to the consumer org
First, create a simple JSON file with the following content:

{

    "email": "<email-address-for-user>", 

    "role_urls": [<url value(s) from the list above (e.g. administrator role)>]

}

Example (I have used the filename member-invite.json, which we then refer to in the next command):

{

    "email": "joe@mail.ibm.com", 

}

Then, we use the apic member-invitations-create command to send an email invitation using the email address in file:

apic member-invitations:create --scope consumer-org --consumer-org <consumer-org-name> --org <provider-org-name> --catalog <catalog-name> --server <apic-address> "./member-invite.json"

The result of this command is that in email is sent to the specified email address, with an invitation link to join the consumer organization as a member.
Step 4: Accept the member invitation
To complete the invitation process, open the email and click on the link. The email subject will be similar to Invitation to an API consumer organization in the Sandbox developer portal.
Step 5A: If you can login to Developer portal then follow below steps:
If you cannot then continue to Step 5B or you are DONE. 
Step 5B: : Get the consumer org members
Having completed the invitation process, use the apic members:list command to display the members of the consumer org, which should now include the newly-invited member. We'll use the URL value for this member in the next step.

apic members:list --scope consumer-org --consumer-org <consumer-org-name> --org <provider-org-name> --catalog <catalog-name> --server <apic-address>

chrisdev2    [state: enabled]   https://apic.dev.ibm.com/api/consumer-orgs/5a494b10-d567-4a5c-a764-ab3bc6018790/8ebed77f-4336-45e3-a81c-f22580ea4293/33c0bb57-d741-4861-9b85-34c1c017bcf8/members/63871a5e-92a5-4345-8f07-eb27xxxxxxx 

In this case, the entry for chrisdev2 is the one we'll use.
Step 6: Transfer ownership of the consumer org to the new member:
To run the apic transfer-owner command, we need another JSON file with the following contents:

{

    "new_owner_member_url": <member-url-value>, 

    "old_owner_new_role_urls": []

}

Example (I have used the filename transfer-owner-member.json, which we then refer to in the next command):

{

    "old_owner_new_role_urls": []

}

The old_owner_new_role_urls value is an empty array, since we're going to be implicitly assigning the owner role when the transfer-owner command runs.
Finally, here is the command to transfer the ownership of the consumer org:

apic consumer-orgs:transfer-owner --org <provider-org-name> --catalog <catalog-name> --server <apic-address> <consumer-org-name> transfer-owner-member.json"

To remove the original owner as a member of the consumer org, you can open the consumer org page in API Manager and delete the member.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSMNED","label":"IBM API Connect"},"ARM Category":[{"code":"a8m50000000Ce9QAAS","label":"API Connect->Developer Portal (MM)"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
22 June 2020

UID

ibm16237064

Page Feedback